SAS 70 AUDIT OF MDVOTERS

Transcription

1 CONSULTING AND TECHNICAL SERVICES (CATS) TASK ORDER REQUEST FOR PROPOSALS (TORFP) SAS 70 AUDIT OF MDVOTERS CATS TORFP PROJECT D38P Maryland State Board of Elections Voter Registration Division and the Office of Information Technology 151 West Street, Suite 200, Annapolis, MD PROJECT NO. SBE Issue Date: December 15,

2 CONTENTS SECTION 1 - ADMINISTRATIVE INFORMATION RESPONSIBILITY FOR TORFP AND TO AGREEMENT TO AGREEMENT TO PROPOSAL SUBMISSIONS ORAL PRESENTATIONS/INTERVIEWS MINORITY BUSINESS ENTERPRISE (MBE) EMARYLANDMARKETPLACE FEE CONFLICT OF INTEREST NON-DISCLOSURE AGREEMENT LIMITATION OF LIABILITY CEILING...7 SECTION 2 - SCOPE OF WORK PURPOSE AND BACKGROUND TECHNICAL REQUIREMENTS CONTRACTOR EXPERTISE REQUIRED CONTRACTOR MINIMUM QUALIFICATIONS RETAINAGE INVOICING REPORTING CHANGE ORDERS...16 SECTION 3 - TASK ORDER PROPOSAL FORMAT AND SUBMISSION REQUIREMENTS REQUIRED RESPONSE FORMAT...17 SECTION 4 - PROCEDURE FOR AWARDING A TASK ORDER AGREEMENT EVALUATION CRITERIA TECHNICAL CRITERIA SELECTION PROCEDURES

3 4.4 COMMENCEMENT OF WORK UNDER A TO AGREEMENT...21 ATTACHMENT 1 SAMPLE PRICE PROPOSAL...22 ATTACHMENT 2 MINORITY BUSINESS ENTERPRISE FORMS...23 ATTACHMENT 3 TASK ORDER AGREEMENT...32 ATTACHMENT 4 CONFLICT OF INTEREST AFFIDAVIT AND DISCLOSURE...35 ATTACHMENT 5 LABOR CLASSIFICATION PERSONNEL RESUME SUMMARY...36 ATTACHMENT 6 DIRECTIONS...38 ATTACHMENT 7 NOTICE TO PROCEED...39 ATTACHMENT 8 AGENCY RECEIPT OF DELIVERABLE FORM...40 ATTACHMENT 9 AGENCY ACCEPTANCE OF DELIVERABLE FORM...41 ATTACHMENT 10 NON-DISCLOSURE AGREEMENT (OFFEROR)...42 ATTACHMENT 11 NON-DISCLOSURE AGREEMENT (TO CONTRACTOR)...43 KEY INFORMATION SUMMARY SHEET This Consulting and Technical Services (CATS) Task Order Request for Proposals (TORFP) is issued to obtain the services necessary to satisfy the requirements defined in Section 2 - Scope of Work. All CATS Master Contractors approved to perform work in the functional area under which this TORFP is released are invited to submit a Task Order (TO) Proposal to this TORFP. All Master Contractors must complete and submit a Master Contractor Feedback form via the CATS web site regardless of whether a TO Proposal is submitted or not. The form is accessible via, your CATS Master Contractor login screen and clicking on TORFP Feedback Response Form from the menu. In addition to the requirements of this TORFP, the Master Contractors are subject to all terms and conditions contained in the CATS TORFP issued by the Maryland Department of Budget and Management (DBM), Office of Information Technology (OIT) and subsequent Master Contract Project Number 050R , including any amendments. TORFP Title: Functional Area: SAS 70 Audit of MDVOTERS Functional Area #9 IT and Telecommunications Financial and Auditing Consulting Services 3

4 TORFP Issue Date: 12/15/2006 Closing Date and Time: TORFP Issuing Agency: Send Questions and Proposals to: TO Procurement Officer: TO Manager: TO Project Number: TO Type: Period of Performance: MBE Goal: Small Business Reserve (SBR): 2/1/2007 at 12:00 PM EST State Board of Elections (SBE), Office of Information Technology John Clark Suite 200, 151 West Street, Annapolis, MD Joseph Torre Office Phone Number: Office FAX Number: Michael Kortum Office Phone Number: Office FAX Number: D38P Fixed price deliverables 60 business days from Notice to Proceed. 10 percent No Primary Place of Performance: Saber Corporation has offices in Portland, Oregon (Harrison Square, 1800 SW 1st Ave., Suite 350, Portland, OR 97201); in Salem, Oregon (3995 Hagers Grove Rd SE, Salem, OR 97301); and a Project Office in Annapolis, Maryland (77 West Street, Annapolis, MD 21401). Saber operates and supports the MDVOTERS Voter Registration Operation Center (VROC) in Annapolis, Maryland, and a Continuity of Operations (COOP) backup data center in Cumberland, Maryland. TO Pre-proposal Conference: Suite 200, 151 West Street, Annapolis, MD /11/2007 at 10:00 AM See Attachment 6 for directions. 4

5 SECTION 1 - ADMINISTRATIVE INFORMATION 1.1 RESPONSIBILITY FOR TORFP AND TO AGREEMENT The TO Procurement Officer has the primary responsibility for the management of the TORFP process, for the resolution of TO Agreement scope issues, and for authorizing any changes to the TO Agreement. See Section 2.8 for information on change orders. The TO Manager has the primary responsibility for the management of the work performed under the TO Agreement; administration functions, including issuing written directions; ensuring compliance with the terms and conditions of the CATS Master Contract; and, in conjunction with the selected Master Contractor, achieving on budget/on time/on target (e.g., within scope) completion of the Scope of Work. 1.2 TO AGREEMENT Based upon an evaluation of TO Proposal responses, a Master Contractor will be selected to conduct the work defined in Section 2 - Scope of Work. A specific TO Agreement, Attachment 3, will then be entered into between the State and the selected Master Contractor, which will bind the selected Master Contractor (TO Contractor) to the contents of its TO Proposal, including the price proposal. 1.3 TO PROPOSAL SUBMISSIONS The TO Procurement Officer will not accept submissions after the stated date and exact time. The time will be local time as determined by the State Board of Elections system time stamp. The TO Proposal is to be submitted via as two attachments in MS Word format. The subject line in the submission shall state the TORFP D38P The first file will be the TO Proposal technical response to this TORFP and titled, CATS TORFP D38P Technical. The second file will be the financial response to this CATS TORFP and titled, CATS TORFP D38P Financial. The proposal documents that must be submitted with a signature, Attachment 2 - MBE Forms D-1 and D-2 and Attachment 4 - Conflict of Interest and Disclosure Affidavit, must be submitted as.pdf files with signatures clearly visible. 1.4 ORAL PRESENTATIONS/INTERVIEWS All Master Contractors and proposed staff will be required to make an oral presentation to State representatives. Significant representations made by a Master Contractor during the oral presentation shall be submitted in writing. All such representations will become part of the Master Contractor s proposal and are binding, if the Contract is awarded. The Procurement Officer will notify Master Contractor of the time and place of oral presentations. 1.5 MINORITY BUSINESS ENTERPRISE (MBE) An overall MBE subcontract participation goal of 10% of the total TORFP dollar amount has been established for this procurement. A Master Contractor that responds to this TORFP shall complete, sign, and submit all required MBE documentation (Attachment 2 - Forms D-1 and D-2) at the time it submits 5

6 its TO Proposal. Failure of the Master Contractor to complete, sign, and submit all required MBE documentation at the time it submits its TO Proposal will result in the State s rejection of the Master Contractor s TO Proposal. 1.6 emarylandmarketplace FEE COMAR requires that each Master Contractor that wins a TO Agreement under this TORFP pay a fee to support the operation of emarylandmarketplace. The fee will be due on each TO Agreement that exceeds $25,000. The applicable fee will be based on TO value, including any options. Contractors shall pay the fee as provided by COMAR and in accordance with guidelines issued by the Maryland Department of General Services. A copy of COMAR and the guidelines issued by the Maryland Department of General Services can be found on the emarylandmarketplace web site at The rate(s) or price(s) of the proposal/bid shall include the appropriate fee as per the COMAR fee schedule. Fees may not be quoted as a separate add-on price. A total TO Agreement value that is other than an even dollar amount will be rounded to the nearest whole dollar to determine the appropriate fee level. For example, a total TO Agreement value of $50, will be rounded to $50,000 and a Level 1 fee will apply. A total TO Agreement value of $50, will be rounded to $50,001 and a Level 2 fee will apply. 1.7 CONFLICT OF INTEREST The TO Contractor awarded the TO Agreement shall provide IT technical and/or consulting services for State agencies or component programs with those agencies, and must do so impartially and without any conflicts of interest. Each Master Contractor shall complete and include a Conflict of Interest Affidavit in the form included as Attachment 4 this TORFP with its TO Proposal. If the TO Procurement Officer makes a determination that facts or circumstances exist that give rise to or could in the future give rise to a conflict of interest within the meaning of COMAR A, the TO Procurement Officer may reject a Master Contractor s TO Proposal under COMAR B. Master Contractors should be aware that the State Ethics Law, State Government Article, , might limit the selected Master Contractor's ability to participate in future related procurements, depending upon specific circumstances. 1.8 NON-DISCLOSURE AGREEMENT Certain system documentation may be available for potential Offerors to review at a reading room at the State Board of Elections address. Offerors who review such documentation will be required to sign a Non-Disclosure Agreement (Offeror) in the form of Attachment 10. Please contact the TO Procurement Officer of this TORFP to schedule an appointment. In addition, certain documentation may be required by the TO Contractor awarded the TO Agreement in order to fulfill the requirements of the TO Agreement. The TO Contractor, employees and agents who review such documents will be required to sign, including but not limited to, a Non-Disclosure Agreement (TO Contractor) in the form of Attachment 11. 6

7 1.9 LIMITATION OF LIABILITY CEILING Pursuant to Section 28(C) of the CATS Master Contract, the limitation of liability per claim under this TORFP shall not exceed the total TO Agreement amount established. 7

8 2.1 PURPOSE AND BACKGROUND PURPOSE SECTION 2 - SCOPE OF WORK The Voter Registration Division and Office of Information Technology of the Maryland State Board of Elections are issuing this TORFP to obtain independent auditing services: to conduct a Statement on Accounting Standards Number 70 information technology system audit (SAS 70 Audit) of MDVOTERS; to identify controls placed by Saber on MDVOTERS software application development and MDVOTERS system operation; to conduct tests when deemed necessary by the SAS 70 Contractor on the operating effectiveness of these software and operational controls; and, to provide a report only to SBE that includes) cost-effective, actionable recommendations on how to strengthen controls on the system. This is an information technology system audit, and not a financial audit of MDVOTERS. This TORFP will result in a single award for a not to exceed amount of $80, for the SAS 70 Audit. The award will be made to a company that SBE determines is able to provide the levels of service described in this solicitation for the contract period, based on the evaluation criteria detailed in Section REQUESTING AGENCY BACKGROUND The Administrator of the State Board of Elections (SBE) is the chief election official for Maryland. The SBE Offices are located in Annapolis, Maryland, and house 35 full time staff plus contractors. The 23 counties of Maryland and the City of Baltimore each have a local board of elections (LBE). SBE provides policy and direction in the conduct of statewide elections to the LBEs. In November 2006 there were 3,353,241 voters registered with an active or inactive status in the state PROJECT BACKGROUND To comply with the Help America Vote Act of 2002 (HAVA), Linda H. Lamone, the State Administrator for Elections, initiated a formal systems project in January 2003 and tasked a project management team to implement a new voter registration system before January 1, In April 2005, SBE contracted with Saber Corporation to provide a single, centralized, statewide voter registration database (with redundancy and failover provisions) on a secure, fault-tolerant platform. The new system called MDVOTERS went live with all 24 LBEs in December Under the MDVOTERS contract, Saber is tasked to provide: (1) project management; (2) a total system solution, involving hardware, application software, and data communications capability; (3) data conversion; (4) data system coordination with internal SBE systems and other agencies; (5) ongoing Voter Registration Operations Center (VROC) and Continuity of Operations (COOP) system operations, maintenance, and support; and (6) the transition of existing voter registration database systems of SBE and 24 local boards of elections (LBEs) into a single, centralized, statewide VRS. MDVOTERS operates using a GOCO model: Government Owned (SBE) - Contractor Operated (Saber Corporation). The State Director of Voter Registration provides voter registration policy and program direction at SBE and advises the Local Boards. The MDVOTERS Project Manager, working closely with 8

9 the Saber Project Director, directs MDVOTERS project planning and development activity. The SBE Chief Information Officer provides information technology technical direction for system security, hardware, and network operations at SBE and supports the Local Boards technology needs. Saber Corporation has offices in Portland, Oregon (Harrison Square, 1800 SW 1st Ave., Suite 350, Portland, OR 97201); in Salem, Oregon (3995 Hagers Grove Rd SE, Salem, OR 97301); and a Project Office in Annapolis, Maryland (77 West Street, Annapolis, MD 21401). Saber operates and supports the MDVOTERS Voter Registration Operation Center (VROC) in Annapolis, Maryland, and a Continuity of Operations (COOP) backup data center in Cumberland, Maryland. The MDVOTERS system uses Saber Corporation s ELECTUS product, configured for Maryland. MDVOTERS employs a web-browser user interface and an Oracle 10i database. MDVOTERS is accessed real-time by authorized Elections Officials through a state-owned, closed, secure network. Following the base period of the MDVOTERS contract that ends on December 31, 2006, SBE plans to exercise renewal contract options requiring Saber to provide ongoing applications maintenance; VROC and COOP operations management; network management; and maintenance support of the statewide VRS. 2.2 TECHNICAL REQUIREMENTS SBE requires the SAS 70 Auditor: to conduct a Statement on Accounting Standards Number 70 information technology system audit (SAS 70 Audit) of MDVOTERS; to identify controls placed by Saber Corporation on MDVOTERS software application development and MDVOTERS system operation; to conduct tests when deemed necessary by the SAS 70 Auditor on the operating effectiveness of these software and operational controls; and, to provide a report of findings to SBE that includes (where necessary) cost-effective, actionable recommendations on how to strengthen controls on the system. This is an information technology system audit, and not a financial audit of MDVOTERS. Neither the TO Contractor nor any subcontractors performing work under the agreement resulting from this TORFP shall be a provider of voter registration or voting systems solutions to governmental entities operating in the United States or its territories currently or within the past five years PROJECT APPROACH The SAS 70 audit is to be performed primarily at the Saber Corporation offices located in Portland, Oregon (Harrison Square, 1800 SW 1st Ave., Suite 350, Portland, OR 97201) and in Salem, Oregon (3995 Hagers Grove Rd SE, Salem, OR 97301). The audit may entail limited work at the Saber office in Annapolis, Maryland (77 West Street, Annapolis, MD 21401), the Voter Registration Operations Center (VROC) in Annapolis, and the Continuity of Operations (COOP) site in Cumberland, Maryland The SAS 70 audit must focus on work and processes that have been performed or are being performed by Saber specifically for SBE for MDVOTERS and not on work performed for other states or on other systems. 9

10 2.2.2 DELIVERABLES For each written deliverable, draft and final, the TO Contractor shall submit to the TO Manager five hard copies and one electronic copy compatible with Microsoft Office 2000 and Microsoft Project The Preliminary Audit Report serves as a draft of the Final Audit Report, and is required at least two weeks in advance of the Final Audit Report. The Preliminary Audit Report must demonstrate due diligence in meeting the scope and requirements of the Final Audit Report. The Preliminary report may contain limited structural errors such as poor grammar, misspellings or incorrect punctuation, but must: A) Be presented in a format appropriate for the subject matter and depth of discussion. B) Be organized in a manner that presents a logical flow of the deliverable s content. C) Represent factual information reasonably expected to have been known at the time of submittal. D) Present information that is relevant to the Section of the deliverable being discussed. E) Represent a significant level of completeness towards the associated final written deliverable that supports a concise final deliverable acceptance process. Upon completion of a deliverable, the TO Contractor shall document each deliverable in final form to the TO Manager for acceptance. The TO Contractor shall memorialize such delivery in an Agency Receipt of Deliverable Form (Attachment 8). The TO Manager shall countersign the Agency Receipt of Deliverable Form indicating receipt of the contents described therein. Upon receipt of a final deliverable, the TO Manager shall commence a review of the deliverable as required to validate the completeness and quality in meeting requirements. Upon completion of validation, the TO Manager shall issue to the TO Contractor notice of acceptance or rejection of the deliverables in an Agency Acceptance of Deliverable Form (Attachment 9). In the event of rejection, the TO Contractor shall correct the identified deficiencies or non-conformities. Subsequent project tasks may not continue until deficiencies with a deliverable are rectified and accepted by the TO Manager or the TO Manager has specifically issued, in writing, a waiver for conditional continuance of project tasks. Once the State s issues have been addressed and resolutions are accepted by the TO Manager, the TO Contractor will incorporate the resolutions into the deliverable and resubmit the deliverable for acceptance. Accepted deliverables shall be invoiced within 30 days in the applicable invoice format (Reference 2.6 Invoicing). When presented for acceptance, a written deliverable defined as a final document must satisfy the scope and requirements of this TORFP for that deliverable. Final written deliverables shall not contain structural errors such as poor grammar, misspellings or incorrect punctuation, and must: A) Be presented in a format appropriate for the subject matter and depth of discussion. B) Be organized in a manner that presents a logical flow of the deliverable s content. C) Represent factual information reasonably expected to have been known at the time of submittal. D) Present information that is relevant to the Section of the deliverable being discussed. 10

11 Deliverables/Tasks. The State required deliverables are defined below. Within each task, the TO Contractor may suggest other subtasks or deliverables to improve the quality and success of the project A written SAS 70 Audit Plan that includes: A description (overview) of the TO Contractor s approach to auditing the areas of: (1) documenting application software requirements; (2) preparing functional and technical specifications; (3) designing and developing MDVOTERS software; (4) conducting and documenting unit, integration, and regression testing; (5) documenting and following quality control and quality assurance processes; (6) identifying the controls placed by Saber Corporation on MDVOTERS software application development and MDVOTERS system operation; and, (7) testing the operating effectiveness of these software and operational controls. The TO Contractor shall produce an audit that will accurately document and report on the degree of compliance of Saber Corporation s processes with the SAS 70 standard. Note This audit shall not involve the financial records of the firm, but is an information technology systems audit of Saber processes and controls on MDVOTERS A timetable with dates for completion of the key activities and deliverables in the Audit The industry practices or standards against which the MDVOTERS Contractor (Saber) will be measured for Compliance A proposed Table of Contents for the Final Audit Report. The Final Audit Report must include: (1) A two page Executive Summary of significant audit findings and recommendations, written in lay terms for reading by Board Members and Executive Staff. (2) A full description of audit findings, tests conducted, graphics as applicable, and references to industry standards applied The Master Contractor s method for managing (responding to) the audited firm s (Saber s) responses to audit findings and recommendations The SBE MDVOTERS Project Manager and SBE CIO will review the Audit Plan. Following TORFP award, the TO Contractor will deliver five printed copies and a CD version to SBE for review. When SBE accepts the Contractor s Audit Plan, the TO Contractor shall conduct the SAS 70 Audit according to the accepted Plan Every two weeks the TO Contractor shall provide a written Status Report to the MDVOTERS Project Manager and CIO on the conduct of the audit. These Status Reports shall give the progress made to date, significant issues uncovered, and any administrative problems encountered in the conduct of the audit that may require SBE action No more than 45 business days from the Audit Plan Approval date (see 2.2.3), the TO Contractor shall provide a SAS 70 Preliminary Audit Report to the MDVOTERS Project Manager and CIO. The Contractor will deliver five printed copies and a CD version to SBE for review. The contents of the 11

12 Preliminary Audit Report shall include audit review of at least the following areas of Saber Corporation s processes specifically used for MDVOTERS: (1) documentation of SBE requirements for application software changes; (2) preparation of functional and technical specifications for MDVOTERS software; (3) design and development of MDVOTERS software; (4) documentation of unit, integration, and regression testing for MDVOTERS software; (5) documentation of the quality control and quality assurance processes used for MDVOTERS; (6) identification of the controls placed by Saber Corporation on MDVOTERS software application development and MDVOTERS system operation; and, (7) tests deemed necessary by the SAS 70 Auditor of the operating effectiveness of Saber s software and operational controls The TO Contractor shall schedule a meeting to present the Preliminary Audit Report to key SBE staff in Annapolis, Maryland. The purposes of the meeting will be to discuss the audit findings and to identify any inconsistencies or misunderstandings in the Preliminary Report (e.g., concerning procedures or controls in place) before preparation of the Final Audit Report. SBE may (at SBE s sole discretion) invite Saber representatives or staff from other State agencies to attend this meeting Upon acceptance of the Preliminary Audit Report by SBE, and no more than 60 business days from the Notice to Proceed, the TO Contractor shall provide a written SAS 70 Final Audit Report that incorporates any corrections needed to the SBE Contract Manager and Technical Project Manager. The Contractor will deliver five printed copies and a CD version to SBE for review. The Audit Report shall address at least the following areas of Saber Corporation s processes for MDVOTERS: (1) documentation of SBE requirements for application software changes; (2) preparation of functional and technical specifications for MDVOTERS software; (3) design and development of MDVOTERS software; (4) documentation of unit, integration, and regression testing for MDVOTERS software; (5) documentation of the quality control and quality assurance processes used for MDVOTERS; (6) identification of the controls placed by Saber Corporation on MDVOTERS software application development and MDVOTERS system operation; and, (7) tests deemed necessary by the SAS 70 Auditor of the operating effectiveness of Saber s software and operational controls; and, (8) includes (where necessary) cost-effective, actionable Recommendations on how to strengthen controls on the system The TO Contractor s CEO and Senior Officer under whose direction the SAS 70 information technology system audit has been conducted shall sign the Final Audit Report. These Officers shall certify in writing that the audit has been prepared in accordance with SAS 70 requirements If requested by SBE, the TO Contractor shall schedule a meeting to present the Final Audit Report to key SBE staff in Annapolis, Maryland. The purposes of the meeting will be to discuss the audit findings and recommendations (if any). SBE may (at SBE s sole discretion) invite Saber representatives or staff from other State agencies to attend this meeting DELIVERABLE/ DELIVERY SCHEDULE The Deliverables under this Contract are: TORFP Deliverables for Expected Completion: 12

13 Section ID Deliverable A. SAS 70 Audit Plan. The TO Contractor, shall provide to the Contract Manager and Technical Project Manager a written SAS 70 Audit Plan within 5 business days of the Notice to Proceed. The Plan shall include the items listed in paragraph Deliverable B. Status reports. The TO Contractor shall provide a Status Report to the Contract Manager on the conduct of the audit every two weeks. The Report shall present progress made to date, significant issues uncovered, and any problems encountered in the conduct of the audit that may require SBE action Deliverable C. SAS 70 Preliminary Audit Report. No more than 45 business days from the Notice to Proceed, the Contractor shall provide a written SAS 70 Preliminary Audit Report that shall be presented to SBE and SBE-identified Saber representatives for discussion prior to release of the final report Deliverable D. The TO Contractor shall schedule a meeting to present the Preliminary Audit Report to key SBE staff in Annapolis, Maryland Deliverable E. SAS 70 Final Audit Report. No more than 60 business days from the Notice to Proceed, the TO Contractor shall provide a written SAS 70 Final Audit Report to the SBE Contract Manager and Technical Project Manager. The CEO and Senior Officer in the firm under whose direction the Audit has been conducted shall sign the Final Audit Report. NTP + 5 Business Days Every 14 Business Days after NTP NTP + 45 Business Days NTP + 45 Business Days NTP + 60 Business Days Deliverables shall be five printed documents in Microsoft Word format, accompanied by one client CD copy of the documents unless otherwise specified. All text shall have a minimum 12-pitch font. Each Deliverable shall be securely mailed or hand delivered to the MDVOTERS Project Manager, John Clark or in his absence to the SBE Chief Information Officer, Michael Kortum, for receipt. All deliverables shall be marked Attention: John Clark (or Michael Kortum) -- Confidential for SBE use only. Unless specifically authorized in writing by the SBE CIO (Michael Kortum) or MDVOTERS Project Manager (John Clark), shall not be used as a means of delivery of TO Deliverables. The TO Contractor will memorialize such delivery in a Receipt of Deliverables Confirmation (see Attachment G), which sets forth the nature and condition of the deliverables, the medium of delivery, and the date of delivery. The SBE Contract Manager will countersign the Receipt of Deliverables Confirmation to indicate receipt. 13

14 Following receipt of a deliverable the SBE Contract Manager (CM) will begin SBE review. Upon completion of review, the CM will issue an Acceptance of Deliverables document (see Attachment H) that provides notice of acceptance or rejection of the deliverable. The CM will notify the Contractor in writing of acceptance, corrections needed, or rejection within fifteen (15) business days after receipt. Electronic notification ( ) is considered to constitute written notification. In the event the SBE rejects a Deliverable provided by the Contractor, the SBE may, in its sole discretion, require the Contractor to correct the deficiencies and resubmit the corrected Deliverable with five (5) business days of Contractor s having received notice REQUIRED PROJECT POLICIES, GUIDELINES AND METHODOLOGIES The TO Contractor shall be required to comply with all applicable laws, regulations, policies, standards and guidelines affecting information technology projects, which may be created or changed periodically. The TO Contractor shall adhere to and remain abreast of current, new, and revised laws, regulations, policies, standards and guidelines affecting project execution. These may include, but are not limited to: A) The State s System Development Life Cycle (SDLC) methodology at: - keyword: SDLC. B) The State Information Technology Security Policy and Standards at: - keyword: Security Policy. As part of this requirement, whenever connected to SBE's LAN/WAN the Contractor shall use only State computer and network equipment. No Contractor equipment may be connected to SBE s LAN/WAN. C) The State Information Technology Project Oversight at: - keyword: IT Project Oversight. D) The State of Maryland Enterprise Architecture at - keyword: MTAF Guiding Principles. 2.3 CONTRACTOR EXPERTISE REQUIRED The TO Contractor and proposed staff must document a professional level of expertise in conducting SAS 70 Audits on Information Technology Systems used in large organizations with a minimum of 1 million customers. Staff is required to submit evidence of qualification such as CISA (Certified Information System Auditor). This SAS 70 Audit of MDVOTERS is not a financial audit of a corporation or a financial system, but an audit of an information technology system used for statewide voter registration purposes. 2.4 CONTRACTOR MINIMUM QUALIFICATIONS The following minimum qualifications are mandatory. The TO Contractor shall be capable of furnishing all necessary services required to successfully complete all tasks and work requirements and produce high 14

15 quality deliverables described herein. The TO Contractor shall demonstrate, in its proposal, that it possesses such expertise in-house or has fostered strategic alliances with other firms for providing such services: Experience and Capability of conducting Statement on Accounting Standards Number 70 audits (SAS 70 Audits) of companies providing information technology systems Experience and Capability of testing--and reporting on the effectiveness of--the controls placed in operation by companies providing information technology systems (software and operational) Experience and Capability of providing cost-effective, actionable recommendations on the findings of the SAS 70 Audit of the Maryland statewide voter registration system (MDVOTERS) Master Contractor is required to submit evidence of qualification such as CISA (Certified Information System Auditor) for proposed staff. 2.5 RETAINAGE Five percent of each deliverable invoiced amount will be retained until final acceptance of the final deliverable under this TORFP. 2.6 INVOICING Payment will only be made upon completion and acceptance of the deliverables as defined in Invoice payments to the TO Contractor shall be governed by the terms and conditions defined in the CATS Master Contract. Invoices for payment shall contain the TO Contractor's Federal Tax Identification Number, as well as the information described below, and must be submitted to the TO Manager for payment approval. Payment of invoices will be withheld if a signed Acceptance of Deliverable form Attachment 9, is not submitted. The TO Contractor shall submit invoices for payment upon acceptance of separately priced deliverables, on or before the 15 th day of the month following receipt of the approved notice(s) of acceptance from the TO Manager. A copy of the notice(s) of acceptance shall accompany all invoices submitted for payment INVOICE SUBMISSION PROCEDURE This procedure consists of the following requirements and steps: A) The invoice shall identify the State Board of Elections as the TO Requesting Agency, deliverable description, associated TO Agreement number, date of invoice, period of performance covered by the invoice, and a TO Contractor point of contact with telephone number. B) The TO Contractor shall send the original of each invoice and supporting documentation (itemized billing reference for employees and any subcontractor and signed Acceptance of Deliverable form Attachment 9, for each deliverable being invoiced) submitted for payment to the State Board of Elections at the following address: ATTN: Robyn Terry, SBE, Suite 200, 151 West Street Annapolis, MD C) Invoices for final payment shall be clearly marked as FINAL and submitted when all work requirements have 15

16 been completed and no further charges are to be incurred under the TO Agreement. In no event shall any invoice be submitted later than 60 business days from the TO Agreement termination date MBE PARTICIPATION REPORTS Monthly reporting of MBE participation is required in accordance with the terms and conditions of the CATS Master Contract by the 15 th day of each month. The TO Contractor shall provide a completed MBE Participation form (Attachment 2, Form D-5) to ASM at the same time the invoice copy is sent. The TO Contractor shall ensure that each MBE Subcontractor provides a completed MBE Participation Form (Attachment 2, Form D-6). Subcontractor reporting shall be sent directly from the subcontractor to DBED. DBED will monitor both the TO Contractor s efforts to achieve the MBE participation goal and compliance with reporting requirements. The TO Contractor shall all completed forms, copies of invoices and checks paid to the MBE directly to the TO Procurement Officer and TO Manager. 2.7 REPORTING The TO Contractor and the TO Requesting Agency shall conduct bi-weekly progress meetings. A biweekly project progress report shall be submitted three (3) business days prior to the meeting to the TO Manager and shall contain, at a minimum, the following information: TO Requesting Agency name, TO Agreement number, functional area name and number, reporting period and Progress Report to be included in the subject line. Work accomplished during the two-week period. Deliverable progress, stated as a percentage of 100% completion of the deliverable. Problem areas - include scope creep or deviation from the work plan. Planned activities for the next reporting period. Time schedule for deliverables updated from the original to show actual progress; as applicable, give explanations for variances and Contractor s plan for completion on schedule. An accounting report for the current reporting period and a cumulative summary of the totals for both the current and previous reporting periods. The accounting report shall include amounts invoiced-to-date and paid-to-date. 2.8 CHANGE ORDERS If the TO Contractor is required to perform additional work, or there is a work reduction due to unforeseen scope changes, the TO Contractor and TO Manager shall negotiate a mutually acceptable price modification based on the TO Contractor s proposed rates in the Master Contract and scope of the work change. No scope of work modifications shall be performed until a change order is executed by the TO Procurement Officer. 16

17 SECTION 3 - TASK ORDER PROPOSAL FORMAT AND SUBMISSION REQUIREMENTS 3.1 REQUIRED RESPONSE Each Master Contractor receiving this CATS TORFP must respond within the submission time designated in the Key Information Summary Sheet. Each Master Contractor is required to submit one of two possible responses: 1) a proposal or 2) a completed Master Contractors Response (submit electronically from CATS web site) 3.2 FORMAT If a Master Contractor elects to submit a TO Proposal, the Master Contractor shall do so in conformance with the requirements of this CATS TORFP. A TO Proposal shall provide the following: THE TECHNICAL PORTION OF THE TO PROPOSAL SHALL INCLUDE A. Proposed Services Work Plan Requirements: A detailed discussion of the Master Contractor s understanding of the work and the Master Contractor s capabilities, approach and solution to address the requirements outlined in Section 2. Master Contractor shall provide as part of its proposal a written SAS 70 Audit Plan that includes: A.1. A description (overview) of the Offeror s planned approach to auditing the areas of: (1) documenting application software requirements; (2) preparing functional and technical specifications; (3) designing and developing MDVOTERS software; (4) conducting and documenting unit, integration, and regression testing; (5) documenting and following quality control and quality assurance processes; (6) identifying the controls placed by Saber Corporation on MDVOTERS software application development and MDVOTERS system operation; and, (7) testing the operating effectiveness of these software and operational controls A.2. Offerors must present a formal, structured approach to the audit that will provide accurate documentation and reporting of the degree of compliance of Saber Corporation s processes with the SAS 70 standard. Note This audit shall not involve the financial records of the firm, but is an information technology systems audit of Saber processes and controls on MDVOTERS A.3. A timetable with dates for completion of the key activities and deliverables in the Audit A.4. The industry practices or standards against which the MDVOTERS Contractor will be measured for Compliance A.5. A proposed Table of Contents for the Final Audit Report. The Final Audit Report must include: (1) A two page Executive Summary of significant audit findings and recommendations, written in lay terms for reading by Board Members and Executive Staff. 17

18 (2) A full description of audit findings, tests conducted, graphics as applicable, and references to industry standards applied A.6. The Master Contractor s method for managing (responding to) an audited firm s responses to audit findings and recommendations A.7 The SBE MDVOTERS Project Manager and CIO will review the Audit Plan. Following TORFP award, the TO Contractor will deliver five printed copies and a CD version to SBE for review. When SBE accepts the Contractor s Audit Plan, the TO Contractor shall conduct the SAS 70 Audit according to the accepted Plan. 2) Assumptions: A description of any assumptions formed by the Master Contractor in developing the Technical Proposal. 3) Risk Assessment: An assessment of any risks inherent in the work requirements and actions to mitigate these risks. 4) Proposed Solution: A description of the Master Contractor s proposed solution to accomplish the specified work requirements. 5) Proposed Tools: A description of all proposed tools that will be used to facilitate the work. 6) Tasks and Deliverables: A description of and the schedule for each task and deliverable, illustrated by a Gantt chart. Start and completion dates for each task, milestone, and deliverable shall be indicated. The Gantt chart will form the baseline for task order monitoring, and will be updated bi-weekly as part of progress reporting (see Section 2.7.1). 7) Work Breakdown Structure: A detailed work breakdown structure and staffing schedule, with labor hours by skill category that will be applied to meet each milestone and deliverable, and to accomplish all specified work requirements. 8) Acceptance Criteria: A statement acknowledging the Master Contractor s understanding of the acceptance criteria. B) Proposed Personnel 1) Identify and provide resumes for all proposed personnel. The resume should highlight the proposed personnel s applicable responsibilities and accomplishments and their applicable industry certifications, e.g., Certified Information Systems Auditor, as they relate to the requirements of this TORFP. Each resume will detail the level of education and work history directly related to performing SAS 70 type audits of information technology. Identify the SAS 70 engagements completed by the individuals in the past five years, and a name and phone number of a contact person at the audited organization. 2) Certification that all proposed personnel meet the minimum required qualifications and possess the required certifications in accordance with Section 2.8. The Contractor shall assign sufficient numbers of Certified Information Systems Auditors and Certified Information Systems Security Auditors, and any other industry Certified specialists considered necessary by the Contractor to conduct a thorough SAS 70 audit of the MDVOTERS Contractor (Saber Corporation). 18

19 3) Provide the names and titles of all key management personnel who will be involved with supervising the services rendered under this TO Agreement. 4) Complete and provide, at the interview, Attachment 5 Labor Classification Personnel Resume Summary. C) MBE Participation 1) Submit completed MBE documents Attachment 2 - Forms D-1 and D-2. D) Subcontractors 1) Identify all proposed subcontractors, including MBEs, and their full roles in the performance of this TORFP Scope of Work. E) Master Contractor and Subcontractor Experience and Capabilities 1) Provide three examples of projects that you have completed within the past five years that were similar in scope to the one defined in this TORFP Scope of Work. Each of the three examples must include a reference, to be provided at the interview, complete with the following: A) Name of organization. B) Name, title, and telephone number of point-of-contact for the reference. C) Type and duration of contract(s) supporting the reference. D) The services provided, scope of the contract and performance objectives satisfied as they relate to the scope of this TORFP. E) Whether the Master Contractor is still providing these services and, if not, an explanation of why it is no longer providing the services to the client organization. 2) State of Maryland Experience: If applicable, the Master Contractor shall submit a list of all contracts it currently holds or has held within the past five years with any government entity of the State of Maryland. For each identified contract, the Master Contractor shall provide: A) The State contracting entity, B) A brief description of the services/goods provided, C) The dollar value of the contract, D) The term of the contract, E) Whether the contract was terminated prior to the specified original contract termination date, F) Whether any available renewal option was not exercised, G) The State employee contact person (name, title, telephone number and address. This information will be considered as part of the experience and past performance evaluation criteria in the TORFP. F) State Assistance 19

20 1) Provide an estimate of expectation concerning participation by State personnel. G) Confidentiality 1) A Master Contractor should give specific attention to the identification of those portions of its proposal that it considers confidential, proprietary commercial information or trade secrets, and provide justification why such materials, upon request, should not be disclosed by the State under the Public Information Act, Title 10, Subtitle 6, of the State Government Article of the Annotated Code of Maryland. Contractors are advised that, upon request for this information from a third party, the TO Procurement Officer will be required to make an independent determination regarding whether the information may be disclosed THE FINANCIAL RESPONSE OF THE TO PROPOSAL SHALL INCLUDE A) A description of any assumptions on which the Master Contractor s Financial Proposal is based; and, B) Attachment 1 A completed and assigned Financial Proposal using Attachment 1 as presented in this TORFP, and including the reference paragraph #, Deliverable identification letter (A, B, C, etc.) of each deliverable under the TORFP; Title of the deliverable; proposed price for each deliverable in whole $US, and the Total proposed price for the SAS 70 Audit Contract in whole $US. 20

21 SECTION 4 - PROCEDURE FOR AWARDING A TASK ORDER AGREEMENT 4.1 EVALUATION CRITERIA The TO Contractor will be selected from among all eligible Master Contractors within the appropriate functional area responding to the CATS TORFP. In making the TO Agreement award determination, the TO Requesting Agency will consider all information submitted in accordance with Section TECHNICAL CRITERIA The following are technical criteria for evaluating a TO Proposal in descending order of importance. Evaluated Resumes. (See Section and of this TORFP) Resumes will be provided for the persons proposed to perform the audit work and for the persons proposed to prepare the audit reports. Technical Response to TORFP Requirements. Master Contractor response to Section 2 of this TORFP that illustrates a comprehensive understanding of work requirements, to include an explanation of how the work will be done. Responses to work requirements such as concur or will comply will receive a lower evaluation ranking than those that demonstrate understanding of the work requirement and a plan to meet or exceed it. References. (See Section E) 1). Master Contractor Experience and Capabilities. (See Section E) 4.3 SELECTION PROCEDURES TO Proposals deemed technically qualified will have their financial proposal considered. All others will receive notice from the TO Procurement Officer of not being selected to perform the work. Qualified TO Proposal financial responses will be reviewed and ranked from lowest to highest price proposed. The most advantageous TO Proposal offer considering technical and financial submission shall be selected for the work assignment. In making this selection, technical merit has greater weight. 4.4 COMMENCEMENT OF WORK UNDER A TO AGREEMENT Commencement of work in response to a TO Agreement shall be initiated only upon issuance of a fully executed TO Agreement, Purchase Order and by a Notice to Proceed authorized by the TO Procurement Officer. See Attachment 7 - Notice to Proceed (sample). Version

22 ATTACHMENT 1 SAMPLE PRICE PROPOSAL Sample Price Proposal for CATS TORFP D38P Paragraph Title of Deliverable Reference Identification # of Deliverable Deliverable A. SAS 70 Audit Plan. The Offeror selected as Contractor, shall provide to the Contract Manager and Technical Project Manager a written SAS 70 Audit Plan within 5 business days of the Notice to Proceed. The Plan shall include the items listed in paragraph Deliverable B. Status reports. The Contractor shall provide a Status Report to the Contract Manager on the conduct of the audit every two weeks. The Report shall present progress made to date, significant issues uncovered, and any problems encountered in the conduct of the audit that may require SBE action Deliverable C. SAS 70 Preliminary Audit Report. No more than 45 business days from the Notice to Proceed, the Contractor shall provide a written SAS 70 Preliminary Audit Report that shall be presented to SBE and SBE-identified Saber representatives for discussion prior to release of the final report Deliverable D. The Contractor shall schedule a meeting to present the Preliminary Audit Report to key SBE staff in Annapolis, Maryland Deliverable E. SAS 70 Final Audit Report. No more than 60 business days from the Notice to Proceed, the Contractor shall provide a written SAS 70 Final Audit Report to the SBE Contract Manager and Technical Project Manager. The CEO and Senior Officer in the firm under whose direction the Audit has been conducted shall sign the Final Audit Report. Proposed Price in $US (Whole $ only, e.g., $XX.00) $ $ $ $ $ Total Proposed Fixed Price $ X,XXX.XX Authorized Individual Name Company Name Title Company Tax ID # SUBMIT AS A.PDF FILE WITH THE FINANCIAL RESPONSE 22

23 ATTACHMENT 2 MINORITY BUSINESS ENTERPRISE FORMS TO CONTRACTOR MINORITY BUSINESS ENTERPRISE REPORTING REQUIREMENTS CATS TORFP D38P These instructions are meant to accompany the customized reporting forms sent to you by the TO Manager. If, after reading these instructions, you have additional questions or need further clarification, please contact the TO Manager immediately. 1. As the TO Contractor, you have entered into a TO Agreement with the State of Maryland. As such, your company/firm is responsible for successful completion of all deliverables under the contract, including your commitment to making a good faith effort to meet the MBE participation goal(s) established for TORFP. Part of that effort, as outlined in the TORFP, includes submission of monthly reports to the State regarding the previous month s MBE payment activity. Reporting forms D-5 (TO Contractor Paid/Unpaid MBE Invoice Report) and D-6 (Subcontractor Paid/Unpaid MBE Invoice Report) are attached for your use and convenience. 2. The TO Contractor must complete a separate Form D-5 for each MBE subcontractor for each month of the contract and submit one copy to each of the locations indicated at the bottom of the form. The report is due no later than the 15 th of the month following the month that is being reported. For example, the report for January s activity is due no later than the 15 th of February. With the approval of the TO Manager, the report may be submitted electronically. Note: Reports are required to be submitted each month, regardless of whether there was any MBE payment activity for the reporting month. 3. The TO Contractor is responsible for ensuring that each subcontractor receives a copy (e-copy of and/or hard copy) of Form D-6. The TO Contractor should make sure that the subcontractor receives all the information necessary to complete the form properly, i.e., all of the information located in the upper right corner of the form. It may be wise to customize Form D-6 (upper right corner of the form) for the subcontractor the same as the Form D-5 was customized by the TO Manager for the benefit of the TO Contractor. This will help to minimize any confusion for those who receive and review the reports. 4. It is the responsibility of the TO Contractor to make sure that all subcontractors submit reports no later than the 15 th of each month, regardless of whether there was any MBE payment activity for the reporting month. Actual payment data is verified and entered into the State s financial management tracking system from the subcontractor s D-6 report only. Therefore, if the subcontractor(s) do not submit their D-6 payment reports, the TO Contractor cannot and will not be given credit for subcontractor payments, regardless of the TO Contractor s proper submission of Form D-5. The TO Manager will contact the TO Contractor if reports are not received each month from either the prime contractor or any of the identified subcontractors. The TO Contractor must promptly notify the TO Manager if, during the course of the contract, a new MBE subcontractor is utilized. Failure to comply with the MBE contract provisions and reporting requirements may result in sanctions, as provided by COMAR